Security

Secrets

Passwords and key passphrases go in the OS keychain (Apple Keychain, the Windows credential store, or Secret Service on Linux), keyed by session id. Where no keychain exists, a file sealed with a master password is used, readable only after unlock. The sessions SQLite database stores only a has_secret flag. Host names, users and key paths are stored in that database unencrypted.

Known hosts

Quay Term checks the OpenSSH ~/.ssh/known_hosts file (hashed names are supported). For an unknown host it asks you to trust the fingerprint, then appends one line; the file is never rewritten. A changed key causes the connection to be refused. The check runs at every jump hop.

Export encryption

Exports use Argon2id (default 64 MiB, 3 passes) to derive the key and ChaCha20-Poly1305 to encrypt and authenticate. The file starts with the magic bytes QUAYVLT1, and a crafted file cannot demand unbounded memory. Secrets are included only if you choose.

Update signing

The updater plugin holds a public key in the app configuration. Releases carry .sig files and a latest.json, and the app refuses updates that do not verify. The check at launch is on by default, downloads nothing until you click Install, and can be turned off.

Telemetry

Quay Term has no telemetry, analytics or crash reporting. The only outbound endpoint configured is the updater's latest.json on GitHub Releases. The webview content security policy restricts connections to self and IPC.

Caveats

• Quay Term has not had a third-party security audit.
• The installers are not code-signed or notarized. You can verify a download against its SHA-256.